OpsKit vs kubectl-ai
kubectl-ai translates plain English into kubectl commands and can execute them. OpsKit cannot mutate a cluster at all. What that difference means for production access.
Facts about kubectl-ai taken from github.com/GoogleCloudPlatform/kubectl-ai, checked 29 July 2026. Anything their site doesn't state is marked "not stated" rather than guessed at.
What kubectl-ai is
An Apache-2.0 CLI maintained by GoogleCloudPlatform (not an officially supported Google product) that translates natural language into kubectl operations and executes them, with confirmation prompts for resource-modifying commands by default.
What OpsKit is
A Kubernetes and cloud investigation kit for AI coding agents. It adds a read-only MCP connection to your live cluster, investigation skills with explicit evidence requirements, and a safety layer that blocks every mutation verb before it executes.
The short version
kubectl-ai is the faster tool for ad-hoc cluster work — say what you want, it writes and runs the command. That is also the difference that matters: it executes mutations, gated by a confirmation prompt. OpsKit is built for the case where nothing should be able to mutate the cluster, prompt or no prompt, and where the output of a diagnosis is a reviewed pull request. Pick on how much you trust a confirmation dialog at 3am.
Side by side
| Dimension | OpsKit | kubectl-ai |
|---|---|---|
| Primary job | Investigate a failure and cite the evidence behind the conclusion | Translate intent into kubectl operations and run them |
| Can it mutate the cluster | No — blocked by an allowlist hook before the command executes | Yes, with a confirmation prompt for modifying commands by default |
| Safety model | Enforcement — 120+ bypass patterns blocked, MIT-licensed and auditable | Confirmation prompt, which can be skipped by configuration |
| Output of a diagnosis | Evidence-cited hypothesis, then a GitOps PR with a rollback plan | Command output in your terminal |
| Scope | Kubernetes, AWS, GCP, Azure, Terraform, SLOs and incident command | Kubernetes operations |
| Licence and price | Commercial — $19 one-time | Apache 2.0 — free |
Choose kubectl-ai if…
- You want to run cluster operations by describing them, and you're comfortable with the tool executing changes.
- You're working in a dev or staging cluster where mutation is the point.
- You want a free tool with a wide choice of model providers, including local ones.
- You don't need an audit trail of what evidence produced a conclusion.
Choose OpsKit if…
- You're pointing an AI agent at production and need mutation to be impossible, not merely discouraged.
- Your security team needs to read the enforcement code before approving a pilot.
- You want reads scoped to an allowlist of namespaces and labels, enforced in the server and by RBAC.
- You want the fix to land as a reviewable PR, with the investigation attached for the reviewer.
Questions
Doesn't a confirmation prompt make execution safe enough?
+
It depends on who is answering it and when. A prompt is a control that a tired human approves under pressure, and it can be disabled by configuration. OpsKit's position is that an agent with production access should not have the capability at all — which is why the block is a hook the agent cannot talk its way past, and why that hook is open source.
Can OpsKit apply a fix if I want it to?
+
No. The output of a remediation workflow is a patch file or a GitOps pull request. Applying it is your action, through your normal review and deploy path.
Try the free tool first
The Kubernetes YAML linter runs the same class of checks OpsKit's deployment guard applies — free, in your browser, no signup. It's the cheapest way to see how the kit thinks.